Overview

• 🎯 Learning Objectives
• 🏗️ SSO Architecture Overview
• Key Components
• Detailed Step-by-Step Process
• 🎫 Understanding Tokens
• Authorization Code
• Access Token
• Refresh Token
• ID Token
• 🔐 Security Mechanisms
• State Parameter
• PKCE (Proof Key for Code Exchange)
• Nonce
• ⏱️ Session Management
• Session Lifecycle
• Session Duration
• Cross-Application Sessions
• 🔍 Monitoring and Observability
• What to Monitor
• Logging Best Practices
• 🚨 Error Scenarios
• Common Error Flows
• Error Handling Strategy

2. Your Application

• Frontend: User interface, login buttons

• Backend: Handles OAuth flow, stores tokens securely

3. Oten IDP

• Identity Provider: Authenticates users

• Token Service: Issues and validates tokens

• User Store: Manages user accounts and profiles

Detailed Step-by-Step Process

Step 1: User Initiates Login

Step 2: Generate PKCE Parameters

Step 3: Create JAR (JWT-Secured Authorization Request)

Step 4: Redirect to Authorization Endpoint

Step 5: User Authenticates at IDP

Step 6: IDP Issues Authorization Code

Step 7: Handle Callback and Validate

Step 8: Exchange Code for Tokens

Step 9: Store and Use Tokens

Step 10: Token Management

🎫 Understanding Tokens

Authorization Code

• Purpose: Temporary code to exchange for tokens

• Lifetime: Very short (usually 10 minutes)

• Security: Single-use only

• Example: abc123def456ghi789

Access Token

• Purpose: Grants access to protected resources

• Lifetime: Short (15-60 minutes)

• Format: Usually JWT (JSON Web Token)

• Usage: Sent with API requests

Refresh Token

• Purpose: Obtains new access tokens

• Lifetime: Long (days to months)

• Security: Stored securely, can be revoked

• Usage: Automatic token renewal

ID Token

• Purpose: Contains user identity information

• Format: JWT with user claims

• Contents: User ID, email, name, etc.

• Usage: Application knows who the user is

🔐 Security Mechanisms

State Parameter

• Purpose: Prevents CSRF attacks

• How it works: Random value sent and verified

• Implementation: Generated by app, validated on return

PKCE (Proof Key for Code Exchange)

• Purpose: Secures public clients (SPAs, mobile)

• How it works: Code challenge/verifier pair

• Required for: Applications that can't store secrets

Nonce

• Purpose: Prevents replay attacks

• How it works: Random value in ID token

• Usage: OpenID Connect flows

⏱️ Session Management

Session Lifecycle

1. Login: User authenticates, session created

2. Active: User accesses applications

3. Refresh: Tokens renewed automatically

4. Timeout: Session expires due to inactivity

5. Logout: User explicitly logs out

Session Duration

• Access tokens: 15-60 minutes

• Refresh tokens: 7-30 days

• ID tokens: Same as access tokens

• SSO session: 8-24 hours (configurable)

Cross-Application Sessions

• Single logout: Logging out of one app logs out of all

• Session sharing: Login to one app grants access to others

• Centralized control: IT can revoke access globally

🔍 Monitoring and Observability

What to Monitor

• Login success/failure rates

• Token refresh patterns

• Session duration statistics

• Error rates by type

• Performance metrics

Logging Best Practices

• Log authentication events

• Don't log sensitive data (passwords, tokens)

• Include correlation IDs

• Monitor for suspicious patterns

🚨 Error Scenarios

Common Error Flows

1. Invalid credentials: User enters wrong password

2. Expired code: Authorization code takes too long to exchange

3. Invalid client: Application not properly registered

4. Access denied: User cancels authentication

5. Server errors: IDP temporarily unavailable

Error Handling Strategy

• User-friendly messages: Don't expose technical details

• Retry mechanisms: Handle temporary failures gracefully

• Fallback options: Provide alternative authentication methods

• Monitoring: Alert on error rate spikes